CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial o...

Security readout for executives and security teams

This QEMU flaw lets a privileged user inside a VM crash the QEMU process through ESP SCSI command handling in non-DMA mode. The supported business impact is VM outage. The supplied sources do not show host takeover, data theft, or active exploitation. Exposure is most likely on virtualization hosts running QEMU with the affected ESP SCSI emulation reachable from guest VMs. The attacker role is a local guest OS administrator. Exact affected versions are not provided in the bundle. Treat as a controlled but real availability issue. It is most urgent for shared virtualization environments where guest administrators are not fully trusted. Patch during the next security maintenance window unless critical workloads or multi-tenant exposure justify faster action. Mitigation focus: Apply QEMU security updates from your OS or virtualization vendor.; Check Ubuntu, Gentoo, Debian, and Red Hat guidance for fixed package versions.; Limit guest administrator access to trusted operators where possible..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.